File name:

cv1(tareq rezq)‮rcS.pdf

Full analysis: https://app.any.run/tasks/596bf2e3-4835-4027-a46b-c3e2e8bba296
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 28, 2025, 16:24:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
revengerat
remote
rat
revenge
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

CACD3364F7A87FDCA9BA94B2B6BB9279

SHA1:

1BB58535229B9F254D99E7C394AA3F9C69CA88E7

SHA256:

0201AAB7258317554D593C4854A84C35CCAEE887A3E4D701966FE235C87A3AEB

SSDEEP:

12288:UTnoWBehbFqRNfdlCDulsovIE0dXemm4TFlLZhFTz:qnoWcbFOVVQE09ma9Zhxz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates or modifies Windows services

      • LocalxPrpAibcVy.exe (PID: 6048)
      • LocalxPrpAibcVy.exe (PID: 7920)

    • REVENGERAT has been detected (YARA)

      • LocalhhUetZzwZk.exe (PID: 2560)

    • Connects to the CnC server

      • LocalhhUetZzwZk.exe (PID: 2560)
      • LocalgDnftVkInR.exe (PID: 3176)

    • REVENGE has been detected (SURICATA)

      • LocalhhUetZzwZk.exe (PID: 2560)
      • LocalgDnftVkInR.exe (PID: 3176)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6808)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 6808)

    • Disables Windows Defender

      • LocalxPrpAibcVy.exe (PID: 7920)
      • LocalxPrpAibcVy.exe (PID: 6048)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • cv1(tareq rezq)‮rcS.pdf.exe (PID: 2616)
      • LocalnSSVjAIbqa.Scr (PID: 6656)
      • LocaldBqOfvk_DC.Scr (PID: 1244)
      • cv1(tareq rezq)‮rcS.Scr (PID: 1452)

    • Starts application with an unusual extension

      • cv1(tareq rezq)‮rcS.pdf.exe (PID: 2616)
      • cv1(tareq rezq)‮rcS.Scr (PID: 1452)

    • Reads security settings of Internet Explorer

      • cv1(tareq rezq)‮rcS.pdf.exe (PID: 2616)
      • LocalnSSVjAIbqa.Scr (PID: 6656)
      • LocalhhUetZzwZk.exe (PID: 2560)
      • cv1(tareq rezq)‮rcS.Scr (PID: 1452)
      • LocaldBqOfvk_DC.Scr (PID: 1244)

    • Executable content was dropped or overwritten

      • cv1(tareq rezq)‮rcS.pdf.exe (PID: 2616)
      • LocalnSSVjAIbqa.Scr (PID: 6656)
      • cv1(tareq rezq)‮rcS.Scr (PID: 1452)

    • Application launched itself

      • LocalxPrpAibcVy.exe (PID: 1452)
      • LocalxPrpAibcVy.exe (PID: 3032)

    • Starts CMD.EXE for commands execution

      • LocalxPrpAibcVy.exe (PID: 6048)
      • LocalxPrpAibcVy.exe (PID: 7920)

    • Connects to unusual port

      • LocalhhUetZzwZk.exe (PID: 2560)
      • LocalgDnftVkInR.exe (PID: 3176)

    • Contacting a server suspected of hosting an CnC

      • LocalhhUetZzwZk.exe (PID: 2560)
      • LocalgDnftVkInR.exe (PID: 3176)

    • The process executes VB scripts

      • LocalhhUetZzwZk.exe (PID: 2560)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6808)

  • INFO

    • Creates files or folders in the user directory

      • cv1(tareq rezq)‮rcS.pdf.exe (PID: 2616)
      • LocalnSSVjAIbqa.Scr (PID: 6656)
      • cv1(tareq rezq)‮rcS.Scr (PID: 1452)

    • Checks supported languages

      • cv1(tareq rezq)‮rcS.pdf.exe (PID: 2616)
      • LocalhhUetZzwZk.exe (PID: 2560)
      • LocalxPrpAibcVy.exe (PID: 6048)
      • LocalnSSVjAIbqa.Scr (PID: 6656)
      • LocalxPrpAibcVy.exe (PID: 1452)
      • cv1(tareq rezq)‮rcS.Scr (PID: 1452)
      • LocaldBqOfvk_DC.Scr (PID: 1244)
      • LocalgDnftVkInR.exe (PID: 3176)
      • LocalxPrpAibcVy.exe (PID: 3032)
      • LocalxPrpAibcVy.exe (PID: 7920)

    • Process checks computer location settings

      • cv1(tareq rezq)‮rcS.pdf.exe (PID: 2616)
      • LocalnSSVjAIbqa.Scr (PID: 6656)
      • LocalhhUetZzwZk.exe (PID: 2560)
      • LocaldBqOfvk_DC.Scr (PID: 1244)
      • cv1(tareq rezq)‮rcS.Scr (PID: 1452)

    • Reads the computer name

      • cv1(tareq rezq)‮rcS.pdf.exe (PID: 2616)
      • LocalxPrpAibcVy.exe (PID: 6048)
      • LocalhhUetZzwZk.exe (PID: 2560)
      • LocalnSSVjAIbqa.Scr (PID: 6656)
      • LocalxPrpAibcVy.exe (PID: 1452)
      • cv1(tareq rezq)‮rcS.Scr (PID: 1452)
      • LocalxPrpAibcVy.exe (PID: 3032)
      • LocaldBqOfvk_DC.Scr (PID: 1244)
      • LocalgDnftVkInR.exe (PID: 3176)
      • LocalxPrpAibcVy.exe (PID: 7920)

    • Application launched itself

      • AcroCEF.exe (PID: 7260)
      • Acrobat.exe (PID: 5504)
      • Acrobat.exe (PID: 7896)
      • AcroCEF.exe (PID: 7656)

    • Reads the machine GUID from the registry

      • LocalhhUetZzwZk.exe (PID: 2560)
      • LocalgDnftVkInR.exe (PID: 3176)

    • Reads Microsoft Office registry keys

      • LocalnSSVjAIbqa.Scr (PID: 6656)
      • LocaldBqOfvk_DC.Scr (PID: 1244)

    • Reads the software policy settings

      • slui.exe (PID: 7172)
      • slui.exe (PID: 7800)

    • Create files in a temporary directory

      • LocalhhUetZzwZk.exe (PID: 2560)

    • Manual execution by a user

      • cv1(tareq rezq)‮rcS.Scr (PID: 1452)

    • Checks proxy server information

      • slui.exe (PID: 7800)

    • Reads CPU info

      • LocalhhUetZzwZk.exe (PID: 2560)
      • LocalgDnftVkInR.exe (PID: 3176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.1)
.exe | Win32 Executable MS Visual C++ (generic) (19.2)
.exe | Win64 Executable (generic) (17)
.scr | Windows screen saver (8)
.dll | Win32 Dynamic Link Library (generic) (4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:28 16:24:20+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 376832
InitializedDataSize: 8192
UninitializedDataSize: -
EntryPoint: 0x5d70e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: cv1(tareq rezq).pdf
LegalCopyright:
OriginalFileName: cv1(tareq rezq).pdf
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
192
Monitored processes
50
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cv1(tareq rezq)‮rcs.pdf.exe #REVENGERAT localhhuetzzwzk.exe localnssvjaibqa.scr localxprpaibcvy.exe no specs localxprpaibcvy.exe conhost.exe no specs acrobat.exe acrobat.exe no specs localxprpaibcvy.exe conhost.exe no specs cmd.exe no specs sppextcomobj.exe no specs slui.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs svchost.exe acrocef.exe no specs slui.exe wscript.exe no specs cv1(tareq rezq)‮rcs.scr #REVENGE localgdnftvkinr.exe localdbqofvk_dc.scr no specs localxprpaibcvy.exe no specs localxprpaibcvy.exe conhost.exe no specs acrobat.exe acrobat.exe no specs localxprpaibcvy.exe conhost.exe no specs cmd.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs sechealthui.exe no specs securityhealthhost.exe no specs securityhealthhost.exe no specs securityhealthhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -EmbeddingC:\Windows\System32\SecurityHealthHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Security Health Host
Exit code:
0
Version:
4.18.1907.16384 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\securityhealthhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
668C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
728C:\WINDOWS\system32\cmd.exe /c pauseC:\Windows\System32\cmd.exe—LocalxPrpAibcVy.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1096"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2748 --field-trial-handle=1640,i,17828393982883680448,23246577980034223,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1244"C:\Users\admin\AppData\LocaldBqOfvk_DC.Scr" /SC:\Users\admin\AppData\LocaldBqOfvk_DC.Scr—cv1(tareq rezq)‮rcS.Scr
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\localdbqofvk_dc.scr
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1452"C:\Users\admin\AppData\LocalxPrpAibcVy.exe" C:\Users\admin\AppData\LocalxPrpAibcVy.exe
LocalnSSVjAIbqa.Scr
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\localxprpaibcvy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1452"C:\Users\admin\Desktop\cv1(tareq rezq)‮rcS.Scr" /SC:\Users\admin\Desktop\cv1(tareq rezq)‮rcS.Scr
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\cv1(tareq rezq)‮rcs.scr
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2552"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2776 --field-trial-handle=1620,i,4059135235747909448,16244138829338755756,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2560"C:\Users\admin\AppData\LocalhhUetZzwZk.exe" C:\Users\admin\AppData\LocalhhUetZzwZk.exe
cv1(tareq rezq)‮rcS.pdf.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
4294967295
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\localhhuetzzwzk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
31 249
Read events
31 008
Write events
219
Delete events
22

Modification events

(PID) Process:(6656) LocalnSSVjAIbqa.ScrKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids
Operation:writeName:Acrobat.Document.DC
Value:
(PID) Process:(5504) Acrobat.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934
Operation:writeName:DisplayName
Value:
Adobe Acrobat Reader Protected Mode
(PID) Process:(5416) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(6048) LocalxPrpAibcVy.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features
Operation:writeName:TamperProtection
Value:
0
(PID) Process:(6048) LocalxPrpAibcVy.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(6048) LocalxPrpAibcVy.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:writeName:SecurityHealth
Value:
0300000005020000DF2A211A
(PID) Process:(6048) LocalxPrpAibcVy.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
Operation:writeName:DisableAntiSpyware
Value:
1
(PID) Process:(6048) LocalxPrpAibcVy.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend
Operation:writeName:Start
Value:
3
(PID) Process:(6048) LocalxPrpAibcVy.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
Operation:writeName:DisableRealtimeMonitoring
Value:
1
(PID) Process:(6048) LocalxPrpAibcVy.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wscsvc
Operation:writeName:Start
Value:
4
Executable files
5
Suspicious files
316
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
6656LocalnSSVjAIbqa.ScrC:\Users\admin\AppData\LocalxPrpAibcVy.exeexecutable
MD5:10FC8B2915C43AA16B6A2E2B4529ADC5
SHA256:FEB09CC39B1520D228E9E9274500B8C229016D6FC8018A2BF19AA9D3601492C5
5416Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEventsbinary
MD5:5F484A06564F30D95E835955160B8315
SHA256:56758C0D68172175B2840280C8CDB773EFE06276D182852D3DA0CC58BD113A84
5416Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTINGbinary
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
7260AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0binary
MD5:27DCE5ADB2B9D208ABF5EDE0DC0397FA
SHA256:8FDFB6178E9AA7B8BD7E3F9D4F8F85AFE836A5276771A3BECDB4C4D897DA10D5
5416Acrobat.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.1.20093.6 2025-04-28 16-25-14-356.logtext
MD5:460C6041966002D8384A18C895A65EB0
SHA256:C83EC6E8FB3EC62481289C033238C1D9B08DB8076EAAD304099FD7A7F594F1B9
2616cv1(tareq rezq)‮rcS.pdf.exeC:\Users\admin\AppData\LocalhhUetZzwZk.exeexecutable
MD5:A9C9B0FB9B012EB0005CC067503022CE
SHA256:2877ED00F077A7412509F62D55BFF4815D9110E16EA9C48E893186FC3507C1C2
5416Acrobat.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txttext
MD5:96BA5B369213EA7DEAFC5E89282BE048
SHA256:2CBA3A43C1B7A9495B979AF87F1F57612FC3B998A646C697A1D0EC73F109AFF3
5416Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.jsonbinary
MD5:837C1211E392A24D64C670DC10E8DA1B
SHA256:8013AC030684B86D754BBFBAB8A9CEC20CAA4DD9C03022715FF353DC10E14031
7260AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF10de9a.TMPtext
MD5:D012E5B4EB91B61F6E8AE2F8EC3C623E
SHA256:1BDA750084F20306722008016420E1912BA608CA8EFB9C661F7E7EFCF5E89673
6656LocalnSSVjAIbqa.ScrC:\Users\admin\AppData\LocalOVeFYgCHbh.pdfpdf
MD5:CC0E4A7BAC80936BE92FB8637A130FDA
SHA256:0BF37B52ABC4F41A7BCC0174883DDF52233D289CE1E56270A99CAB2AD7956B7A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
45
DNS requests
30
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.190:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5504
Acrobat.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
—
—
whitelisted
8016
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8016
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4156
SystemSettings.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4156
SystemSettings.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.190:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2560
LocalhhUetZzwZk.exe
147.185.221.25:58434
25.ip.gl.ply.gg
PLAYIT-GG
US
malicious
7468
AcroCEF.exe
95.100.184.205:443
geo2.adobe.com
AKAMAI-AS
FR
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.190
  • 23.48.23.145
  • 23.48.23.139
  • 23.48.23.181
  • 23.48.23.140
  • 23.48.23.194
  • 23.48.23.192
  • 23.48.23.146
  • 23.48.23.183
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
25.ip.gl.ply.gg
  • 147.185.221.25
malicious
geo2.adobe.com
  • 95.100.184.205
whitelisted
p13n.adobe.io
  • 52.202.204.11
  • 23.22.254.206
  • 52.5.13.197
  • 54.227.187.23
whitelisted
login.live.com
  • 20.190.160.132
  • 40.126.32.72
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.20
  • 20.190.160.128
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
2560
LocalhhUetZzwZk.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Revenge-RAT Check-In
2560
LocalhhUetZzwZk.exe
Malware Command and Control Activity Detected
ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2
2560
LocalhhUetZzwZk.exe
Malware Command and Control Activity Detected
ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2
2560
LocalhhUetZzwZk.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Revenge-RAT Check-In
3176
LocalgDnftVkInR.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Revenge-RAT Check-In
3176
LocalgDnftVkInR.exe
Malware Command and Control Activity Detected
ET MALWARE MSIL/Revenge-RAT Keep-Alive Activity (Outbound) M2
3176
LocalgDnftVkInR.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Revenge-RAT Check-In
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cv1(tareq rezq)‮rcS.pdf